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METHOD AND APPARATUS FOR ENHANCING NETWORK 
SECURITY PROTECTION SERVER PERFORMANCE 



RELATED APPLICATIONS 

This application claims the benefit of United States Provisional 
Application Number 60/211,023 filed 06/12/2000, and Application Number 
60/21 1,031, filed 6/12/2000, both of which are incorporated herein by reference. 

FIELD OF THE INVENTION 

The claimed invention relates to the field of secure communications. 
More particularly it relates to improving the efficiency of secure network 
communications. 

BACKGROUND OF THE INVENTION 

Many network transactions today require secure communications. To 
establish a secure communication link protocols such as Secure Socket Layer 
("SSL") and Transport Layer Security ("TLS") must be accomplished. Today 
SSL is the most widely deployed protocol for securing communication on the 
World Wide Web ("WWW"). The protocol is used by most E-commerce and 
financial web sites as it guarantees privacy and authenticity of information 
exchanged between a web server and a web browser. Currently, the number of 
web sites using SSL to secure web traffic is growing at a phenomenal rate and 
as the services provided on the World Wide Web continue to expand so will the 
need for security using SSL. 
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Unfortunately, neither SSL or TLS are cheap. A number of studies have 
shown that web servers using the SSL protocol perform far worse than web 
servers that do not encrypt web traffic. In particular, a web server using SSL 
can handle 30 to 50 times fewer transactions per second than a web server using 
5 clear-text communication only can. The exact transaction performance 

degradation depends on the type of web server used by the site. To overcome 
this degradation web sites using secure connections typically buy significantly 
more hardware in order to provide a reasonable response time to their 
customers. 

1 0 Web sites often use one of two techniques to overcome security's impact 

on performance. The first method, as indicated above, is to deploy more 
machines at the web site and load balance connections across these machines. 
This is problematic since more machines are harder to administer. In addition, 
mean time between failures decreases significantly. The other solution is to 

15 install a hardware acceleration card inside the web server. The card handles 

most of the secure protocol workload thus enabling the web server to focus on 
its regular tasks. Accelerator cards are available from a number of vendors and 
while these cards reduce the penalty of using secure protocols, they are 
relatively expensive and are non-trivial to configure. Thus there is a need to 

20 quickly establish secure transactions at a lower cost. 
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SUMMARY OF THE INVENTION 

A method and apparatus for enhancing security protection server 
performance in a computer network is provided when a web browser first 
5 connects to a web server using secure protocols, the browser and server execute 

an initial handshake protocol. The outcome of this protocol is a session 
encryption key and a session integrity key. These keys are only known to the 
web server and web browser, and establish a secure session. 

Once session keys are established, the browser and server begin 

10 exchanging data. The data is encrypted using the session encryption key and 

protected from tampering using the session integrity key. When the browser 
and server are done exchanging data the connection between them is closed. 
This process begins when the web browser connects to the web server and sends 
a client-hello message. Soon after receiving the message, the web server 

15 responds with a server-hello message. This message contains the server's public 

key certificate that informs the client of the server's Ri vest- Shamir- Adleman 
algorithm ("RSA") public key. Having received the public key, the browser 
picks a random 48-byte string, R, and encrypts it using the key. Letting Cbe 
the resulting cipher-text of the string R, the web browser then sends a client- 

20 key-exchange message containing C. The 48-byte string R is called the pre- 

master- secret. Upon receiving the message, from the browser, the web server 
uses its RSA private key to decrypt C and thus learns R. Both the browser and 
server then use R and some other common information to derive the session 
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keys. With the session keys established, encrypted message can be sent 

between the browser and server with impunity. 

The decryption of the encrypted string, R, is the expensive part of the 

initial handshake. An RSA public key is made of two integers (TV, e). In an 
5 embodiment N = pq is the product of two large primes and is typically 1 024 bits 

long. The value e is called the encryption exponent and is typically some small 

number such as e = 65537. Both N and e are embedded in the server's public 

key certificate. The RSA private key is simply an integer d satisfying e ■ d = 1 

mod (p-\)(q-l). Given an RSA cipher-text C, the web server decrypts C by 
1 0 using its private key to compute C 1 mod N that reveals the plain-text message, 

R. Since both d and N are large numbers (each 1024 bits long) this computation 

takes some effort. 

At a later time, the browser may reconnect to the same web server. 

When this happens the browser and server executes the resume handshake 
15 protocol. This protocol causes both server and browser to reuse the session 

keys established during the initial handshake saving invaluable resources. All 

application data is then encrypted and protected using the previously established 

session keys. 

Of the three phases, the initial handshake is often the reason why secure 
20 connections degrade web server performance. During this initial handshake the 

server performs an RSA decryption or an RSA signature generation. Both 
operations are relatively expensive and the high cost of the initial handshake is 
the main reason for supporting the resume handshake protocol. The resume 
handshake protocol tries to alleviate the cost of the initial handshake by reusing 
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previously negotiated keys across multiple connections. However, in the web 
environment, where new users constantly connect to the web server, the 
expensive initial handshake must be executed over and over again at a high 
frequency. Hence, the need for reducing the cost of the initial handshake 
5 protocols. 

One embodiment presents an implementation of batch RSA in an SSL 
web server while other embodiments present substantial improvements to the 
basic batch RSA decryption algorithms. These embodiments show how to 
reduce the number of inversions in the batch tree to a single inversion. Another 

1 0 embodiment further speeds up the process by proper use of the Chinese 

Remainder Theorem ("CRT") and simultaneous multiple exponentiation. While 
the Secure Socket Layer ("SSL") protocol is a widely utilized technique for 
establishing a secure network connection, it should be understood that the 
present invention can be applied to the establishment of any secure network 

1 5 based connection using a plurality of protocols. 

A different embodiment entails architecture for building a batching 
secure web server. The architecture in this embodiment is based on using a 
batching server process that functions as a fast decryption oracle for the main 
web server processes. The batching server process includes a scheduling 

20 algorithm to determine which subset of pending requests to batch. 

Yet other embodiments improve the performance by reducing the 
handshake work on the server per connection. One technique supports web 
browsers that deal with a large encryption exponent in the server's certificate, 
while another approach supports any browser. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

The present invention is illustrated by way of example in the following 
figures in which like references indicate similar elements. The following 
figures disclose various embodiments of the claimed invention for purposes of 
5 illustration only and are not intended to limit the scope of the claimed invention. 

Figure 1 is a flow diagram of the initial handshake between a web 
server and a client of an embodiment. 

Figure 2 is a flow diagram for increasing efficiency of the initial 
handshake process by utilizing cheap keys of an embodiment. 
10 Figure 3 is a flow diagram for increasing efficiency of the initial 

encryption handshake by utilizing square keys in an embodiment. 

Figure 4 is a block diagram of an embodiment of a network system for 
improving secure communications. 

Figure 5 is a flow diagram for managing multiple certificates using a 
1 5 batching architecture of an embodiment. 

Figure 6 is a flow diagram of batching encrypted messages prior to 
decryption of an embodiment. 
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DETAILED DESCRIPTION 

The establishment of a secure network connection can be improved by 
altering the steps of the initial handshake. One embodiment for the 
improvement to the handshake protocol focuses on how the web server 
5 generates its RSA key and how it obtains a certificate for its public key. By 

altering how the browser uses the server's public key to encrypt a plain-text R, 
and how the web server uses its private key to decrypt the resulting cipher-text 
C, this embodiment provides significant improvements to Secure Socket Layer 
("SSL") communications. While the Secure Socket Layer protocol is a widely 
1 0 utilized technique for establishing a secure network connection, it should be 

understood that the techniques described herein can be applied to the 
establishment of any secure network-based connection using any number of 
protocols. 

The general process in establishing a Secure Socket Layer 
1 5 communication between a browser or client and a server or host is depicted in 

Figure 1. The process begins with a request from the browser to establish a 
secure session 110. The client forms a hello message requesting a public key 
and transmits the message to the server 114. Upon receiving the client-hello 
message, the web server responds with a server-hello message containing a 
20 public key 118. The public key is one half of a public / private key pair. While 

the server transmits the public key back to the browser the server keeps the 
private key. Once the client receives the public key 122 a random number R is 
generated 126. This random number is the session key. The client encrypts R 
by using the private key that it received from the server 132. With the number 

C:\NrPortbl\PALIBl\MCM\1322410_5.DOC (62299) _-j _ 



R encrypted, the client sends the cipher-text to the web-server 138. Upon 
receiving the cipher-text 142 the web server user the private key portion of the 
public / private key pair to decrypt the cipher-text 146. With both the client and 
the server possessing the session key R, a new encrypted secure socket layer 
5 session 1 60 is established using R as the session key 158. This session is truly 

encrypted since only the client and the web server possess the session key for 
encryption and decryption. 

In one embodiment that improves the establishment of a secure 
connection a server generates an RSA public/private key pair by generating two 

1 0 distinct «-bit primes p and q and computing N =pq. While N can be of any 

arbitrary size, assume for simplicity that N is 1024 bits long and let w = gcd(p - 
l,q -I) where gcd is the greatest common divisor. The server then picks two 
random A;-bit values r\, r 2 such that gcd(r u p - 1) = 1, gcd(r 2 , q-l) = l, and r x = 
r 2 mod w. Typically k falls in the range of 1 60 -5 12 bits in size. Although other 

15 larger values are also acceptable, k is minimized to enhance performance. The 

server then computes d such that d = r\ mod p-l and d = r 2 mod q - 1 . Having 
computed d,e'is found by solving the equation e' = d~ ] mod <p{N) resulting in 
the public key being (N, e') and the private key d, which is a function of two 
random numbers, (r h r 2 ). 

20 The server then sends the public key to a Certificate Authority (CA). 

The CA returns a public key certificate for this public key even though e' is very 
large, namely on the order of N. This is unlike standard RSA public key 
certificates that use a small value of e, e.g. e = 65537. Consequently, the CA 
must be willing to generate certificates for such keys. 
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To find d the Chinese Remainder Theorem is typically used. 
Unfortunately,/? - 1 and q - 1 are not relatively prime (they are both even) and 
consequently the theorem does not apply. However, by letting w = gcd(p -l,q 

- 1), knowing that — — - and ^ — - are relatively prime, and recalling that r x = 

w w 

r 2 = a mod w, the CRT can be used to find an element d' such that 



Observing that the required d is simply d = w ■ d' + a and indeed, 
d = r\ mod p- \ and d = r 2 mod q - 1 , if w is large, the requirement that 
r\ = r 2 mod w reduces the entropy of the private key. For this reason it is 
desirable to ensure that w is small and one embodiment lets w = 2, or namely 
that gcd(p - 1, q - 1) = 2. Recall that gcd(r h p - 1) = 1 and gcd(r 2 , q-l) = l. 
It follows that gcd(d,p - 1) - 1 and gcd(d, q - 1) = 1 and consequently 
gcd(rf, (p - l)(g - 1)) = 1. Hence, d is invertible modulo <p(N) = (p - \){q - 1). 

The web browser obtains the server's public key certificate from the 
server-hello message. In this embodiment, the certificate contains the server's 
public key (N, e). The web browser encrypts the pre-master-secret R using this 
public key in exactly the same way it encrypts using a normal RSA key. Hence, 
there is no need to modify any of the browser's software. The only issue is that 
since e' is much larger than e in a normal RSA key, the browser must be willing 
to accept such public keys. 
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When the web server receives the cipher-text C from the web browser 
the web server then uses the server's private key, (r h r 2 ), to decrypt C. To 
accomplish this the server computes R{ = c h mod/? and R' 2 = c Tj modg. 
Using CRT the server then computes an R e Z N such that R = R{ modp and 
R = R' 2 mod q , noting that R = C? mod N. Hence, the resulting R is a proper 
decryption of C. 

Decryption using a standard RSA public key is completed with C 1 mod 
iV using the CRT. Typically = d dmodp - 1} modp <mdR 2 = << dmoAq - ,} mod 
q is first computed and then the CRT is applied to R h R 2 to obtain R mod N. 
Note that the exponents d mod p — 1 and d mod q — 1 are typically as large as 
p and q, namely 512 bits each. Hence, to generate the signature the server must 
compute one exponentiation modulo p and one exponentiation modulo q. When 
Nis 1024 bits, the server does two full exponentiations modulo 512-bit 
numbers. 

In one embodiment, the server computes R[ t R> 2 and then applies CRT 
to R[ ,R' 2 . As in normal RSA, the bulk of the work is in computing R[ ; R' 2 . 
However, computing R[ requires raising C to the power of r\, which is 
minimized. Since the time that modular exponentiation takes is linear in time to 
the size of the exponent, computing R[ takes approximately one third the work 
and one third of the time of raising C to the power of a 512 bit exponent. 
Hence, computing R[ takes one third the work of computing R u Therefore, 
during the entire decryption process the server does approximately one third the 
work as in a normal SSL handshake. 
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To illustrate the implementation of this embodiment suppose Eve is an 
eavesdropper that listens on the network while the handshake protocol is taking 
place. Eve sees the server's public key {N, e') and the encrypted pre-master- 
secret C. Suppose n < r 2 . It can be shown that an adversary who has (N, e', C) 
5 can mount an attack on the system that runs in time o(<Jr\ log r x )• 

Let (N, e ') be an RS A public key with N = pq and let d e Z be the 
corresponding RSA private key satisfying d = r u mod p - 1 and d = r 2 mod q - 
1 with r } < r 2 . If ri is m bits long and it is assumed that rj^r 2 mod 2 m/2 5 then 
given (N, e'Jan adversary can expose the private key d in time o{ y [r\logr 1 )- 
10 One skilled in the art knows that e' = (n)' 1 mod (p - 1). But, suppose r\ is m- 

bits long. If n = A • 2 m/2 + B where A, B are in [0, 2 m/z ] and a random g e Z N is 
selected combined with the definition 

G{x)=^{ g ^ m ' Z - i -X- g \ 
i=0 v 7 

then if follows that G(g e ' B ) = 0 mod p. This occurs since one of the products 

15 above is 

g W*.A . g e'-B _ g y g Jl _ g = o ( mod/ ,). 

Since r x * r 2 mod 2 m/2 , it can be shown that G(g e ' B )*0 mod q. Hence, gcd (TV, 
G(g e B )) gives a non-trivial factor of N. Hence, if G(x) mod N is evaluated at x 
= g e " 7 fory = 0, . . . , 2 m/1 at least one of the values will expose the factorization 
20 of N. Evaluating a polynomial of degree 2 m/2 at 2 mI2 values can be done in time 

2 m/2 ■ m/2 using Fast Fourier Transform methods. This algorithm requires 
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0\2 m/2 j space. Hence, in time at most o{Jt\ log r x ) we can factor N. Thus in 
order to obtain security of 2 80 , both n and r 2 must be at least 160 bits long. 

Figure 2 is a flow diagram for improving secure socket layer 
communications of an embodiment by altering the public / private key pair. In 
5 operation, the server generates an RSA public / private key pair initiating a 

normal initial handshake protocol 210. At this point the server generates two 
distinct prime numbers 215 and takes the product of the numbers to produce the 
N component of the public key 220. Similarly, the server picks two random 
values to create the private key 225. Using the prime numbers, 215, and the 

1 0 random values of the private key 225 the server computes the value d, 230, and 

correspondingly the value e 235. The result is a new public / private key pair 
240 that the client uses to encrypt the pre-master-secret R 250. Once R has 
been encrypted with the new public key and transmitted to the server as cipher- 
text C, the server uses it private key to decrypt the pre-master-secret 260. Once 

15 Ri and R 2 have been determined 265 they are combined to find R 270. Having 

the value of the pre-master-secret intact, the server and client can establish a 
secure session 280. 

A further embodiment dealing with the handshake protocol reduces the 
work per connection on the web server by a factor of two. This embodiment 

20 works with all existing browsers. As before, the embodiment is illustrated by 

describing how the web server generates its RSA key and obtains a certificate 
for its public key. This embodiment continues in describing how the browser 
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uses the server's public key to encrypt a plain-text R, and the server uses its 
private key to decrypt the resulting cipher-text C. 

In this embodiment the server generates an RSA public/private key pair 
by generating two distinct n-bit primes p and q such that the size of each distinct 
5 prime number is on the order of one third of the size of N. Using this 

relationship the server computes N as N' =p 2 ■ q. The relationship between the 
prime numbers and N is dependent on the power by which one of the prime 
number is raised. For example if one of the prime numbers was raised to the 
fourth power the prime numbers would be on the order of one fifth the size of 

10 N. The exponent of at least one of the prime numbers must be greater than one. 

While clearly JV can be of arbitrary size, assume, in the situation where p is 
raised to the power of two and q is raised to the power of one, that N is 1024 
bits long, and hence p and q are 341 bits each instead of the typical 512 bits. 
The server uses the same e used in standard RSA public keys, namely e = 65537 

1 5 as long as gcd(e, (p - 1) (q - 1 )) = 1 . The server then computes d = e~ l mod (p 

- l)(q - 1) as well as r\ = d mod p - 1 and r 2 = d mod q-1. With the public 
key being <iV, e) and the private key being d, which is a function of (n, r 2 ), the 
server sends the public key, (N 1 , e), to a Certificate Authority (CA) and the CA 
returns a public key certificate. The public key in this case cannot be 

20 distinguished from a standard RSA public key. 

The web browser obtains the server's public key certificate from the 
server-hello message. The certificate contains the server's public key (KF, e). 
The web browser encrypts the pre-master-secret R using this public key in 
exactly the same way it encrypts using a normal RSA key. 
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When the web server receives the cipher-text C from the web browser 
the web server decrypts C by computing R[ = c h modjt? and R' 2 = c ri mod 4 • 
Note that (Rj) e = Cmodp and (R' 2 ) e = C mod q. Lifting the server constructs 
an such that (R") e = Cmodp 2 - More precisely, the server computes 

Using CRT, the server computes an R e Z N such that R = j?[ mod p 2 and 
R = R' 2 mod q noting that R = C* mod N. Hence, the resulting R is a proper 
decryption of C. Recall that when N is 1 024 bits, the server typically does two 
full exponentiations modulo 512-bit numbers. In this embodiment the alteration 

10 of the multiplicity of the roots is compensated by the lifting mechanism. 

In this embodiment the server computes R[ 5 R' 2 5 Rf and then applies 
CRT to R^ R' 2 . The bulk of the work is in computing R[ 5 r' 2 5 Rf but 
computing r{ requires a full exponentiation modulo a 341 -bit prime rather than 
a 512-bit prime. The same holds for R' 2 . Hence in this embodiment, 

15 computing R{ , R' 2 takes approximately half the time of computing R u R 2 . 

Furthermore, computing R^ from R{ only requires a modular inversion modulo 
p 2 . This takes little time when compared with the exponentiations for 
computing r{ , R' 2 . Hence, using this embodiment the handshake takes 
approximately half the work of a normal handshake on the server. 
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Some accelerator cards do not provide support for modular inversion. 
As a result, the inversion is preformed using an exponentiation. This is done by 
observing that for any x e z* the inverse of x is given by: 

x" 1 = x p2_p_1 (modp 2 )- 
Unfortunately, using an exponentiation to do the inversion hurts performance. 
As discussed herein a better embodiment for inversion in this case is batching. 
One can invert two numbers Xl , x 2 e Z* as a batch faster than inverting the two 
numbers separately. To do so use the fact that 

xf 1 =x 2 ■(x l x 2 )~ l and x" 1 = x, • (x^J -1 (modp 2 )- 
Hence, at the cost of inverting xi ■ x 2 it is possible to invert both xi and x 2 . This 
embodiment shows that an inversion of k elements x 1; ...,x k e Z* is at the cost 
of one inversion and k log 2 k multiplications. Thus, the amortized cost of a 
single inversion is Ilk of an exponentiation plus log 2 £ multiplications. 

To take advantage of batched inversion in the SSL handshake a number 
of instances of the handshake protocol are collected from among different users 
and the inversion is preformed on all handshakes as a batch. As a result, the 

amortized total number of exponentiations per handshake is 2 + — • This 

k 

approximately gives a factor of two improvement in the handshake work on the 
server as compared to the normal handshake protocol. 

The security of the improved handshake protocol depends on the 
difficulty of factoring integers of the form N=p 2 ■ q. When 1024 bit keys are 
used the fastest factoring algorithms (i.e. the number field sieve) cannot take 
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advantage of the special structure of N. Similarly, p and q are well beyond the 
capabilities of the Elliptic Curve Method (ECM). 

Figure 3 is a flow diagram for modifying the public key of an 
embodiment to facilitate an improvement in secure socket layer communication. 
5 As in other embodiments, the process begins with the servers generation of a 

RSA public / private key pair 310. In this embodiment, the public key is 
modified. The web server generates two distinct prime numbers 312 and 
computes a new N' 318. Using the same exponent 320 the server computes the 
value d 322 which it uses to find the private key 328. The result is a pubic / 

10 private key combination 330 that the sever then sends to the client for the 

encryption of the pre-master-secret 340. Once the server receives the encrypted 
pre-master-secret, R, from the client 350 the server decrypts R 360 by 
computing Rl 362 and R2 368 and combining the results 370. Once R has been 
determined the client can establish a secure session with the client using the 

1 5 new session key 380. 

The establishment of a secure connection between a server and a 
browser can also be improved by batching the initial SSL handshakes on the 
web server. In one embodiment the web server waits until it receives b 
handshake requests from b different clients. It treats these b handshakes as a 

20 batch, or set of handshakes, and performs the necessary computations for all b 

handshakes at once. Results show that, for b = 4, batching the SSL handshakes 
in this way results in a factor of 2.5 speedup over doing the b handshakes 
sequentially, without requiring any additional hardware. 
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One embodiment improves upon a technique developed by Fiat for batch 
RSA decryption. Fiat suggested that one could decrypt multiple RSA cipher- 
texts as a batch faster than decrypting them one by one. Unfortunately, 
experiments show that Fiat's basic algorithm, naively implemented, does not 
5 give much improvement for key sizes commonly used in initial secure 

handshakes. 

A batching web server must manage multiple public key certificates. 
Consequently, a batching web server must employ a scheduling algorithm that 
assigns certificates to incoming connections, and picks batches from pending 

10 requests, so as to optimize server performance. 

To encrypt a message Musing an RSA public key (N, e), the message M 
is formatted to obtain an integer X in {1, . . . , TV}. This formatting is often done 
using the PKCS 1 standard. The cipher-text is then computed as C = X 2 mod TV. 
This process occurs during the initial stages of the initial handshake between a 

1 5 client and server when attempting to create a secure connection. 

To decrypt a cipher-text C the web server uses its private key d to 
compute the e' th root of CinZ N . The e th root of C is given by C 1 mod TV as 
previously noted. Since both d and TV are large numbers (each 1024 bits long) 
this is a lengthy computation on the web server. It is noted that d must be taken 

20 as a large number (i.e., on the order of TV) since otherwise the RSA system is 

insecure. 

When using small public exponents, e\ and e2, which are components of 
the public key, it is possible to decrypt two cipher-texts for approximately the 
price of one. Suppose vi is a cipher-text obtained by encrypting using the 
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public key (N,3). Similarly, imagine v 2 is a cipher-text obtained by encrypting 
using the public key {N, 5). To decrypt vi and v 2 , computing v\ B and V\' s mod 
A'" are made by setting^ = (vi 5 • v 2 3 ) 1/15 it can be shown that 

v, 1/3 = — and v } /5 = — 

1 3 2 2 2 

Vj -V 2 Vj -v 2 

5 Hence, at the cost of computing a single 15 th root both vi and v 2 can be 

decrypted. 

This batching technique is most useful when the public exponents e\ and 
e 2 are very small (e.g., 3 and 5). Otherwise, the extra arithmetic required can be 
expensive. Also, only cipher-texts encrypted using distinct public exponents 

1 0 can be batch decrypted. Indeed, it can be shown that it is not possible to batch 
when the same public key is used. That is, it is not possible to batch the 
computation of v\ /3 and v 2 1/3 . 

This observation to the decryption of a batch of b RSA cipher-texts can 
be generalized. In one embodiment there are b distinct and pairwise relatively 

15 prime public keys e\, . . . ,e b , all sharing a common modulus N = pq. 

Furthermore, assume there are b encrypted messages, vi, . . . , Vb, one encrypted 
with each key, that are desirable to decrypt simultaneously, to obtain the plain- 
texts m . = v- /e '' • 

The batch process is implemented around a complete binary tree with b 
20 leaves, possessing the additional property that every inner node has two 

children. In one embodiment the notation is biased towards expressing locally 
recursive algorithms: Values are percolated up and down the tree. With one 
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exception, quantities subscripted by L or R refer to the corresponding value of 
the left or right child of the node, respectively. For example, m is the value of m 
at a node; m R is the value of m at that node's right child and so forth. 

Certain values necessary to batching depend on the particular placement 
of keys in the tree and may be pre-computed and reused for multiple batches. 
Pre-computed values in the batch tree are denoted with capital letters, and 
values that are computed in a particular decryption are denoted with lower-case 
letters. 

The batching algorithm consists of three phases: an upward-percolation 
phase, an exponentiation phase, and a downward-percolation phase. In the 
upward-percolation phase, the individual encrypted messages v 2 are combined to 
form, at the root of the batch tree, the value 



In preparation, assign to each leaf node a public exponent: E <r- e,. Each inner 
node then has its E computed as the product of those of its children: E <- E L - 
E R . The root node's E will be equal to e, the product of all the public exponents. 
Each encrypted message v,- is placed (as v) in the leaf node labeled with its 
corresponding e t . The v's are percolated up the tree using the following recursive 
step, applied at each inner node: 



v = n ti v i ie ' 5 where e = n *=i e i ■ 




At the completion of the upward-percolation phase, the root node 



contains v = ]~J f = 



vf /e '' • In the exponentiation phase, thee* root of this vis 
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extracted. Here, the knowledge of factorization of JVis required. The 
exponentiation yields v Ve = Y\ * =1 v, 1/e ' > wnicn is stored as m in me root node - 

In the downward-percolation phase, the intent is to break up the product 
m into its constituent subproducts m L and m K , and, eventually, into the 
decrypted messages m £ at the leaves. At each inner node anX is chosen 
satisfying the following simultaneous congraencies: 

X= 0 (mod E L ) X= 1 (mod E R ). 

The value Xis constructed using the Chinese Remainder Theorem ("CRT"). 
Two further numbers, X L and X R , are defined at each node as follows: 

X L = X/E h X K = (X-l)/E K . 

Both divisions are done over the integers. (There is a slight infelicity in the 
naming here: X L andX R are not the same as the Xs of the node's left and right 
children, as implied by the use of the L and R subscripts, but separate values.) 

The values of X, X h , and X R are such that, at each inner node, m x equals 
. v ^r . OTr . This immediately suggests the recursive step used in 
downward-percolation: 

m R <r-m X /(v^ -Vr R ) m L <-m/m R - 

At the end of the downward-percolation process, each leafs m contains 
the decryption of the v placed there originally. Only one large (full-size) 
exponentiation is needed, instead of b of them. In addition, the process requires 
a total of 4 small exponentiations, 2 inversions, and 4 multiplications at each of 
the b - 1 inner nodes. 
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Basic batch RSA is fast with very large moduli, but may not provide a 
significant speed improvement for common sized moduli. This is because 
batching is essentially a tradeoff. Batching produces more auxiliary operations 
in exchange for fewer full-strength exponentiations. 

5 Batching in an SSL-enabled web server focuses on key sizes generally 

employed on the web, e.g., n = 1024 bits. Furthermore, this embodiment also 
limits the batch size b to small numbers, on the order of b = 4, since collecting 
large batches can introduce unacceptable delay. For simplicity of analysis and 
implementation, the values of b are restricted to powers of 2. 

10 Previous schemes perform two divisions at each internal node, for a total 

of 2b - 2 required modular inversions. Modular inversions are asymptotically 
faster than large modular exponentiations, hi practice, however, modular 
inversions are costly. Indeed, the first implementation (with b = 4 and a 1024- 
bit modulus) spends more time doing the inversions than doing the large 

1 5 exponentiation at the root. Two embodiments, when combined, require only a 

single modular inversion throughout the algorithm with the cost of an additional 
0(b) modular multiplication. This tradeoff gives a substantial running-time 
improvement. 

The first embodiment is referred to herein as delayed division. An 
20 important realization about the downward-percolation phase is that the actual 
value of m for the internal nodes of the tree is consulted only for calculating m L 
and m R . An alternative representation of m that supports the calculation of m L 
and m Rj and that can be evaluated at the leaves to yield m would do just as well. 
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This embodiment converts a modular division alb to a "promise," {a, b). 
This promise can operate as though it were a number, and, can "force" getting 
its value by actually computing b' l a. Operations on these promises work in a 
way similar to operations in projective coordinates as follows: 

a/b = {a,b) (a,b) c =(a c ,b c ) 

5 c-(a,b) = (ac, b) (a, b) ■ (c, d) = (ac, bd) ■ 

(a,b)lc = (a, be) (a, b) l(c, d) = (ad, be) 

Multiplication and exponentiation takes twice as much work had these promises 

not been utilized, but division can be computed without resort to modular 

inversion. 

If, after the exponentiation at the root, the root m is expressed as a 
10 promise, m «— {m, 1), this embodiment can easily convert the downward- 

percolation step to employ promises: 

m R <-m x /(vl l -Vr r ) m L <-m/m R - 
No internal inversions are required. The promises can be evaluated at the leaves 
to yield the decrypted messages. 
15 Batching with promises uses b - 1 additional small exponentiations and 

b - 1 additional multiplications. This translates to one exponentiation and one 
multiplication at every inner node, saving 2{b -l)-Z?=b-2 inversions. To 
further reduce the number of inversions, another embodiment uses batched 
divisions. When using delayed inversions one division is needed for every leaf 
20 of the batch tree. In the embodiment using batched divisions, these b divisions 

can be done at the cost of a single inversion with a few more multiplications. 
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As an example of this embodiment, invert three values x, y, and z. 
Continue by forming the partial product yz, xz, and xy and then form the total 
product xyz and invert it, yielding (xyz)' 1 . With these values, calculate all the 
inverses: 

x l = (yz) ■ (xyzj 1 y l = (xz) ■ (xyz) A . 

z A = (xy) ■ (xyz)' 1 

Thus the inverses of all three numbers are obtained at the cost of only a single 
modular inverse along with a number of multiplications. More generally, it can 
be shown that by letting xi, . . . , x n e Z N , all n inverses x' 1 , . . . , x' 1 can be 
obtained at the cost of one inversion and 3n - 3 multiplications. 

It can be proven that a general batched-inversion algorithm proceeds in 
three phases. First, set A\ <- x\, and A t <r- x, • A t -\ for i > 1 . By induction, it can 
be shown that 

Next, invert A n = Y\ x j ' anc * store tne resm<1: m 
B n :B n <- (A n ) _1 = j^fxj 1 • Now, set B t <r- x i+ \ ■ B i+ \ for i < n. Again, it can be 
shown that 

Finally, set Q <- B x , and Q <- A iA • B t for i > 1 . Furthermore, C\ = B\ = 
xi" 1 , and, by combining, Q = A t .\ • B t = xf 1 for i>\. This embodiment has thus 
inverted each x t . 
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Each phase above requires n - 1 multiplications, since one of the n 
values is available without recourse to multiplication in each phase. Therefore, 
the entire algorithm computes the inverses of all the inputs in In - 3 
multiplications and a single inversion. 
5 In another embodiment batched division can be combined with delayed 

division, wherein promises at the leaves of the batch tree are evaluated using 
batched division. Consequently, only a single modular inversion is required for 
the entire batching procedure. Note that the batch division algorithm can be 
easily modified to conserve memory and store only n intermediate values at any 
1 0 given time. 

The Chinese Remainder Theorem is typically used in calculating RSA 
decryptions. Rather than computing m<—v d (mod AO, the modulo p and q is 
evaluated: 

m p <- v d / (mod/?) m q <_ y< (mod q). 

1 5 Here d p = d mod p - 1 and d q = d mod q - 1 . Correspondingly the CRT can 

calculate m from m p and m q . This is approximately 4 times faster than 
evaluating m directly. 

This idea extends naturally to batch decryption. In one embodiment 
each encrypted message v, modulo p and q is reduced. Then, instead of using a 

20 single batch tree modulo N, two separate, parallel batch trees, modulo p and q, 

are used and then combined to the final answers from both using the CRT. 
Batching in each tree takes between a quarter and an eighth as long as in the 
original, unified tree since the number-theoretical primitives employed, as 
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commonly implemented, take quadratic or cubic time in the bit-length of the 
modulus. Furthermore, the b CRT steps required to calculate each m t mod N 
afterwards takes negligible time compared to the accrued savings. 

Another embodiment referred to herein as Simultaneous Multiple 

5 Exponentiation provides a method for calculating a u ■ b v mod m without first 

evaluating a u -b v ■ It requires approximately as many multiplications as does a 
single exponentiation with the larger of u or v as an exponent. 

For example, in the percolate-upward step, V <r- F/ R • V£ L tne entire 
right-hand side can be computed in a single multi-exponentiation. The 

1 0 percolate-downward step involves the calculation of the quantity 

v f L • v r r > wnich can be accelerated similarly. These small-exponentiations-and- 
product calculations are a larger part of the extra bookkeeping work required for 
batching. Using Simultaneous Multiple Exponentiation reduces the time 
required to perform them by close to 50% by combining the exponentiation 

15 process. 

Yet another embodiment involves Node Reordering. Normally there are 
two factors that determine performance for a particular batch of keys. First, 
smaller encryption exponents are better. The number of multiplications 
required for evaluating a small exponentiation is proportional to the number of 
20 bits in the exponent. Since upward and downward percolation both use 0(b) 

small exponentiations, increasing the value of e = Tl e, can have a drastic effect 
on the efficiency of batching. 
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Second, some exponents work well together. In particular, the number 
of multiplications required for a Simultaneous Multiple Exponentiation is 
proportional to the number of bits in the larger of the two exponents. If batch 
trees are built that have balanced exponents for multiple exponentiation (E L and 
5 E R , then X L and X R , at each inner node), the multi-exponentiation phases can be 

streamlined. 

With b = 4, optimal reordering is fairly simple. Given public exponents 
e l <e 2 <e 3 <e A , the arrangement e x - e 4 - e 2 - <? 3 minimizes the disparity 
between the exponents used in Simultaneous Multiple Exponentiation in both 

1 0 upward and downward percolation. Rearranging is harder for b > 4. 

Figure 4 is an embodiment of a system 400 for improving secure 
communications. The system includes multiple client computers 432, 434, 436, 
438 and 440 which are coupled to a server system 410 through a network, 430. 
The network 430 can be any network, such as a local area network, a wide area 

15 network, or the Internet. Coupled among the server system 410 and the network 

430 is a decryption server. While illustrated as a separate entity in Figure 4, the 
decryption server can be located independent of the server system or in the 
environment or among any number of server sites 412, 414 and 416. The client 
computers each include one or more processors and one or more storage 

20 devices. Each of the client computers also includes a display device, and one or 
more input devices. All of the storage devices store various data and software 
programs. In one embodiment, the method for improving secure 
communications is carried out on the system 400 by software instructions 
executing on one or more of the client computers 432 - 440. The software 
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instructions may be stored on the server system 410 any one of the server sites 
412 - 416 or on any one of the client computers 432 - 440. For example, one 
embodiment presents a hosted application where an enterprise requires secure 
communications with the server. The software instructions to enable the 
5 communication are stored on the server and accessed through the network by a 

client computer operator of the enterprise. In other embodiments, the software 
instructions may be stored and executed on the client computer. A user of the 
client computer with the help of a user interface can enter data required for the 
execution of the software instructions. Data required for the execution of the 
1 0 software instructions can also be accessed via the network and can be stored 

anywhere on the network. 

Building the batch RS A algorithm into real-world systems presents a 
number of architectural challenges. Batching, by its very nature, requires an 
aggregation of requests. Unfortunately, commonly-deployed protocols and 
1 5 programs are not designed with RS A aggregation in mind. The solution in one 

embodiment is to create a batching server process that provides its clients with a 
decryption oracle, abstracting away the details of the batching procedure. 

With this approach modifications to the existing servers are minimized. 
Moreover, it is possible to simplify the architecture of the batch server itself by 
20 freeing it from the vagaries of the SSL protocol. An example of the resulting 

web server design is shown in Figure 5. Note that in batching the web server 
manages multiple certificates, i.e., multiple public keys, all sharing a common 
modulus iV 5 10. 
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One embodiment for managing multiple certificates is the two-tier 
model. For a protocol that calls for public-key decryption, the presence of a 
batch-decryption server 520 induces a two-tier model. First is the batch server 
process that aggregates and performs RSA decryptions. Next are client 

5 processes that send decryption requests to the batch server. These client 

processes implement the higher-level application protocol (e.g., SSL) and 
interact with end-user agents (e.g., browsers). 

Hiding the workings of the decryption server from its clients means that 
adding support for batch RSA decryption to existing servers engenders the same 

10 changes as adding support for hardware-accelerated decryption. The only 

additional challenge is in assigning the different public keys to the end-users 
such that there are roughly equal numbers of decryption requests with each e t . 
As the end-user response times are highly unpredictable, there is a limit to the 
flexibility that may be employed in the public key distribution. 

15 If there are k keys each with a corresponding certificate, it is possible to 

create a web with ck web server processes with a particular key assigned to 
each. This approach provides that individual server processes need not be 
aware of the existence of multiple keys. The correct value for c depends on 
factors such as, but not limited to, the load on the site, the rate at which the 

20 batch server can perform decryption, and the latency of the communication with 

the clients. 

Another embodiment accommodates workload unpredictability. The 
batch server performs a set of related tasks including receiving requests for 
decryption, each of which is encrypted with a particular public exponent e,. 
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Having received the requests it aggregates these into batches and performs the 
batch decryption as described herein. Finally, the server responds to the 
requests for decryption with the corresponding plain-text messages. The first 
and last of these tasks are relatively simple I/O problems and the decryption 
stage is discussed herein. What remains is the scheduling step. 

One embodiment possesses scheduling criteria including maximum 
throughput, minimum turnaround time, and minimum turnaround-time variance. 
The first two criteria are self-evident and the third is described herein. Lower 
turnaround-time variance means the server's behavior is more consistent and 
predictable which helps prevent client timeouts. It also tends to prevent 
starvation of requests, which is a danger under more exotic scheduling policies. 

Under these constraints a batch server's scheduling can implement a 
queue where older requests are handled first. At each step the server seeks the 
batch that allows it to service the oldest outstanding requests. It is impossible to 
compute a batch that includes more than one request encrypted with any 
particular public exponent e u This immediately leads to the central realization 
about batch scheduling that it makes no sense, in a batch, to service a request 
that is not the oldest for a particular e t . However, substituting the oldest request 
for a key into the batch improves the overall turnaround-time variance and 
makes the batch server better approximate a perfect queue. 

Therefore, in choosing a batch, this embodiment needs only consider the 
oldest pending request for each e t . To facilitate this, the batch server keeps k 
queues Q t , or one for each key. When a request arrives, it is placed onto the 
queue that corresponds to the key with which it was encrypted. This process 
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takes 0(1) time. In choosing a batch, the server examines only the heads of 
each of the queues. 

Suppose that there are k keys, with public exponents e u . . ., e k , and that 
the server decrypts requests in batches of b messages each. The correct requests 
5 to batch are the b oldest requests from amongst the k queue heads. If the 

request queues Q t are kept in a heap with priority determined by the age of the 
request at the queue head, then batch selection can be accomplished by 
extracting the maximum, oldest-head, queue from the heap, de-queue the 
request at its head, and repeat the process to obtain b requests to batch. After 
1 0 the batch has been selected, the b queues from which requests were taken may 

be replaced in the heap. The entire process takes 0(Mg£) time. 

Another embodiment utilizes multi-batch scheduling. While the process 
described above picks only a single batch, it is possible, in some cases, to 
choose several batches at once. For example, with b = 2,k=3, and requests for 
15 the keys 3-3-5-7 in the queues, the one-step lookahead may choose to do a 5-7 

batch first, after which only the unbatchable 3-3 remain. A smarter server 
could choose to do 3-5 and 3-7 instead. The algorithms for doing lookahead 
are more complicated than the single-batch algorithms. Additionally, since they 
take into account factors other than request age, they can worsen turnaround- 
20 time variance or lead to request starvation. 

A more fundamental objection to multi-batch lookahead is that 
performing a batch decryption takes a significant amount of time. Accordingly, 
if the batch server is under load, additional requests will arrive by the time the 
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first chosen batch has been completed. These can make a better batch available 
than was without the new requests. 

But servers are not always under maximal load. Server design must take 
different load conditions into account. One embodiment reduces latency in a 
5 medium-load environment by using k public keys on the web server and 

allowing batching of any subset of b of them, for some b < k. To accomplish 
this the batches must be pre-constracted and the constants associated with ) 
batch trees must be keep in memory one for each set of e's. 

However, it is no longer necessary to wait for exactly one request with 
10 each e before a batch is possible. For k keys batched b at a time, the expected 

number of requests required to give a batch is 

E[# requests] = k • Y 

Vf k-i + 1 

This equation assumes each incoming request uses one of the k keys 
randomly and independently. With b = 4, moving from k = 4 to k = 6 drops the 
1 5 expected length of the request queue at which a batch is available by more than 

31%, from 8.33 to 5.70. 

The particular relationship of b and k can be tuned for a particular 
server. The batch-selection algorithm described herein is time-performance 
logarithmic in k, so the limiting factor on k is the size of the k th prime, since 
20 particularly large values of e degrade the performance of batching. 

In low-load situations, requests trickle in slowly, and waiting for a batch 
to be available can introduce unacceptable latency. A batch server should have 
some way of falling back on unbatched RSA decryption, and, conversely, if a 
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batch is available and batching is a better use of processor time than unbatched 
RSA, the servers should be able to exploit these advantages. So, by the 
considerations given above, the batch server should perform only a single 
unbatched decryption, then look for new batching opportunities. 

Scheduling the unbatched decryptions introduces some complications. 
Previous techniques in the prior art provide algorithms that when requests 
arrive, a batch is accomplished if possible, otherwise a single unbatched 
decryption is done. This type of protocol leads to undesirable real-world 
behavior. The batch server tends to exhaust its queue quickly. Furthermore it 
responds immediately to each new request and never accumulates enough 
requests to batch. 

One embodiment chooses a different approach that does not exhibit the 
performance degradation associated with the prior art. The server waits for new 
requests to arrive, with a timeout. When new requests arrive, it adds them to its 
queues. If a batch is available, it evaluates it. The server falls back on 
unbatched RSA decryptions only when the request- wait times out. This 
approach increases the server's turnaround-time under light load, but scales 
gracefully in heavy use. The timeout value is tunable. 

Since modular exponentiation is asymptotically more expensive than the 
other operations involved in batching, the gain from batching approaches a 
factor-of-6 improvement only when the key size is improbably large. With 
1024-bit RSA keys the overhead is relatively high and a naive implementation 
is slower than unbatched RSA. The improvements described herein lower the 
overhead and improve performance with small batches and standard key-sizes. 
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Batching provides a sizeable improvement over plain RSA with b = 8 
and n = 2048. More important, even with standard 1024-bit keys, batching 
significantly improves performance. With b = 4, RSA decryption is accelerated 
by a factor of 2.6; with b = 8, by a factor of almost 3.5. These improvements 
5 can be leveraged to improve SSL handshake performance. 

At small key sizes, for example n = 512, an increase in batch size 
beyond b = 4 provides only a modest improvement in RSA performance. 
Because of the increased latency that large batch sizes impose on SSL 
handshakes, especially when the web server is not under high load, large batch 
1 0 sizes are of limited utility for real-world deployment. 

SSL handshake performance improvements using batching can be 
demonstrated by writing a simple web server that responds to SSL handshake 
requests and simple HTTP requests. The server uses the batching architecture 
described herein. The web server is a pre-forked server, relying on "thundering 
15 herd" behavior for scheduling. All pre-forked server processes contact an 

additional batching server process for all RSA decryptions as described herein. 

Batching increases handshake throughput by a factor of 2.0 to 2.5, 
depending on the batch size. At better than 200 handshakes per second, the 
batching web server is competitive with hardware-accelerated SSL web servers, 
20 without the need for the expensive hardware. 

Figure 6 is a flow diagram for improving secure socket layer 
communication through batching of an embodiment. As in a typical initial 
handshake between server and client in establishing a secure connection, the 
client uses the server's public key to encrypt a random string R and then sends 
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the encrypted R to the server 620. The message is then cached 625 and the 
batching process begins by determining is there is sufficient encrypted messages 
coming into the server to form a batch 630. If the answer to that query is no, it 
is determined if the scheduling algorithm has timed out 640. Again if the 
5 answer is no the message returns to be held with other cached messages until a 

batch has been formed or the scheduler has timed out. If the scheduler has 
timed out 640 then the web server receives the encrypted message from the 
client containing R 642 The server then employs the private key of the public / 
private RSA key pair to decrypt the message and determine R 646. With R 

10 determined the client and the server use R to secure further communication 685 

and establish an encrypted session 690. 

Should enough encrypted messages be available to create a batch 630 
the method examines the possibility of scheduling multiple batches 650. With 
the scheduling complete the exponents of the private key are balanced 655 and 

15 the e th root of the combined messages is extracted 658 allowing a common root 

to be determined and utilized 660. The embodiment continues by reducing the 
number of inversions by conducting delayed division 662 and batched division 
668. With the divisions completed, separate parallel batch trees are formed to 
determine the final inversions that are then combined 670. At this point 

20 simultaneous multiple exponents are applied to decrypt the messages 672 which 

are separated 676 and sent to the server in clear text 680. With the server and 
client both possessing the session key R 685 a encrypted session can be 
established 690. 
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Batching increases the efficiency and reduces the cost of decrypting the 
cipher-text message containing the session's common key. By combining the 
decryption of several messages in an optimized and time saving manner the 
server is capable of processing more messages thus increasing bandwidth and 
5 improving the over all effectiveness of the network. While the batching 

techniques described previously are a dramatic improvement in secure socket 
layer communication, other techniques can also be employed to improve the 
handshake protocol. 

From the above description and drawings, it will be understood by those 
10 of ordinary skill in the art that the particular embodiments shown and described 

are for purposes of illustration only and are not intended to limit the scope of 
the claimed invention. 
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